Privacy Policy

Last updated: 7 October 2026

1. Data Controller

PrioPad GmbH
Hainhäuser Weg 126
30855 Langenhagen
Germany
E-Mail: info@openspiro.com

2. OpenSpiro Apps (Desktop and iOS)

The OpenSpiro apps work without an account. Measurements (breath-by-breath values such as VO₂, VCO₂, RER, breath volume, gas concentrations, and optionally heart rate, power and cadence), athlete profiles (name, sex, year of birth, height, weight, maximum heart rate, FTP, sport, notes) and settings are stored locally on your device. Without an account, the apps transmit none of this data to us or to third parties. The apps contain no telemetry, no analytics and no tracking. You can export your data at any time as CSV, JSON or EDF.

The desktop app checks openspiro.com for updates. This transmits your IP address and the app version to our website host (see section 4.1); no personal data from the app is sent.

3. OpenSpiro Account and Cloud (optional, in preparation)

In future, you will be able to create an optional OpenSpiro account (app.openspiro.com) to sync your measurements between devices, share them via link or invitation, and receive comments. This service is not yet available. Only if you create an account and use these functions do we process the following data:

  • Account data: name, email address, password (stored only as a hash) or sign-in via one-time email link, language, time zone, profile picture (optional), subscription status.
  • Profile and measurement data that you sync: the profile and measurement data listed in section 2. This includes health data within the meaning of Art. 9 GDPR.
  • Sharing and comments: share links, invited email addresses, comments, and the view count of a shared session.
  • Technical data: IP address and browser/app information when you sign in (security of your account).

Legal bases: Art. 6(1)(b) GDPR for providing the account and the functions you use; for health data, your explicit consent under Art. 9(2)(a) GDPR, which you can withdraw at any time with effect for the future (e.g. by turning off sync, deleting individual measurements or deleting your account); Art. 6(1)(f) GDPR for the security of the service. Shared measurements are visible only to people who have the link or an invitation; your body weight is never shown in shared views. We do not sell your data. We will only use measurement data for research if you have given separate consent for it.

Storage and deletion: the service will be operated on servers in the EU. Data is stored for as long as you have an account; when you delete measurements or your account, the data is deleted, except where statutory retention obligations apply (e.g. invoices). Payments for paid plans will be processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). Before the service starts, we will add the full list of processors to this policy.

4. This Website (openspiro.com)

4.1 Hosting

This website is hosted by Netlify, Inc. (San Francisco, USA). When you visit this website, your browser automatically transmits certain technical data to the hosting server, including your IP address, browser type, operating system, referrer URL, and timestamp. This data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest in secure and efficient website operation). Server log files are typically deleted after 30 days.

4.2 Cookies

This website does not use cookies for tracking or analytics purposes. A session storage entry may be set to remember your language preference dismissal during a browser session. This data is not transmitted to any server and is deleted when you close your browser.

4.3 Fonts

This website uses locally hosted fonts. No font files are loaded from external servers. No data is transmitted to third parties for font rendering.

4.4 No Analytics or Tracking

This website does not use any analytics tools, tracking pixels, or social media plugins.

4.5 OSM1 Waitlist and Newsletter

If you join the OSM1 waitlist, we process your email address, your shipping country, your chosen language, your optional answers on purchase intent and on what you hope to get from a VO₂ analyzer, as well as the time and IP address of sign-up and confirmation (as proof of your consent). We use a double opt-in: you only get onto the list after clicking the confirmation link we email you. We use this data exclusively to inform you about the OSM1 (pre-order start, availability, product updates), to send you the OpenSpiro newsletter with news about our products and the app, and to plan production and shipping; the shipping country tells us whether we can deliver to you. We use your optional answers to improve our products and to tailor our content and emails to your needs. We only publish answers in aggregated form without reference to you; verbatim quotes with your name only with your separate permission. Legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time via the unsubscribe link in every email or by writing to info@openspiro.com. The list is stored on our own server at Hetzner Online GmbH (Gunzenhausen, Germany) within the EU. Emails are sent via Mailjet SAS (Paris, France) as our processor under a data processing agreement. Your data is deleted when you unsubscribe or when the newsletter is discontinued.

4.6 Spam Protection (Cloudflare Turnstile)

To protect the waitlist form against automated abuse, the OSM1 page loads Cloudflare Turnstile (Cloudflare, Inc., San Francisco, USA). Turnstile evaluates technical signals from your browser (e.g. IP address, browser characteristics) to distinguish humans from bots; it does not use tracking cookies. When you submit the form, our server has the result verified by Cloudflare. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting our systems from spam). Cloudflare is certified under the EU-US Data Privacy Framework. Details: Cloudflare privacy policy at https://www.cloudflare.com/privacypolicy/.

5. Your Rights

Under the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. To exercise these rights, contact us at info@openspiro.com.

6. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.